diff --git a/.github/workflows/check-haproxy-version.yml b/.github/workflows/check-haproxy-version.yml
index cb375ed..c8367f5 100644
--- a/.github/workflows/check-haproxy-version.yml
+++ b/.github/workflows/check-haproxy-version.yml
@@ -129,6 +129,9 @@ jobs:
       # Daily CVE scan of the currently pinned HAProxy. Independent of whether
       # upstream has a new release. Catches CVEs disclosed against the version
       # already shipped to Ray Serve users.
+      - name: Restore pinned sources for scanning
+        run: git checkout --detach "$GITHUB_SHA"
+
       - name: Build current pinned HAProxy for scanning
         run: |
           docker run --rm \
diff --git a/ci/build/build-haproxy-dist.sh b/ci/build/build-haproxy-dist.sh
index e1bae4c..dfd9d98 100755
--- a/ci/build/build-haproxy-dist.sh
+++ b/ci/build/build-haproxy-dist.sh
@@ -128,8 +128,12 @@ echo "==> OpenSSL $(${DEPS_DIR}/bin/openssl version)"
 LUA_SRC="$BUILD_DIR/lua-${LUA_VERSION}"
 
 echo "==> Building Lua ${LUA_VERSION}"
-curl -fsSL -o "$BUILD_DIR/lua.tar.gz" \
-    "https://www.lua.org/ftp/lua-${LUA_VERSION}.tar.gz"
+if ! curl -fsSL --retry 3 --connect-timeout 15 --max-time 120 \
+    -o "$BUILD_DIR/lua.tar.gz" "https://www.lua.org/ftp/lua-${LUA_VERSION}.tar.gz"; then
+    curl -fsSL --retry 3 --connect-timeout 15 --max-time 120 \
+        -o "$BUILD_DIR/lua.tar.gz" \
+        "https://ftp.osuosl.org/pub/blfs/conglomeration/lua/lua-${LUA_VERSION}.tar.gz"
+fi
 verify_checksum "$BUILD_DIR/lua.tar.gz" "$LUA_SHA256" "Lua"
 tar -xzf "$BUILD_DIR/lua.tar.gz" -C "$BUILD_DIR"